Dynamic Distribution Group quirkiness in Exchange 2007

In “New Distribution Groups do not receive internet email by default“, I wrote about Devin’s observation that all new Distribution Groups created in Exchange Server 2007 do not receive internet/unauthenticated email by default.

Here’s some more often overlooked Dynamic Distribution Group (DDG, aka “Query-Based Distribution Group” in Exchange/Windows Server 2003) quirkiness. When creating a new Dynamic Distribution Group using the Exchange shell, you need to specify the required OrganizationalUnit parameter. This tells Exchange which OU or Container the new group should be created in. The RecipientContainer parameter is optional. It sets the scope of the AD query for the Dynamic Distribution Group – only recipients from that OU or Container are returned (and thus get mail sent to that group).

If you do not specify the RecipientContainer parameter, the shell sets it to the same value as the OrganizationalUnit parameter. As a result, the query may not return any recipients at all, or may not return all the recipients you think it should.

The documentation for New-DynamicDistributionGroup does point this out:

If you do not specify a value for RecipientContainer, the default search filter is the location of the dynamic distribution group in Active Directory. This location is specified by using the OrganizationalUnit parameter.

Scenario: If you create all groups in an OU or container called Distribution Groups, which has no users (or recipients other than the groups), the query will not return any users at all because its scope is now set to the Distribution Groups OU or container!

To get the RecipientContainer and OrganizationalUnit parameters of a Dynamic Distribution Group:

Get-DynamicDistributionGroup “MyGroupName” | select Name,RecipientContainer,OrganizationalUnit

Previewing recipients returned by a DynamicDistributionGroup filter
There’s no easy way to view “membership” (or rather, the recipients returned by the Dynamic Distribution Group’s filter) for Dynamic Distribution Groups created using a custom filter. You cannot easily verify whether the group’s picking up the right recipients. You can test by sending messages to the new group and requesting a Delivery Report. However, if no recipients are returned by the filter, the messages disappear into a black hole, never to be heard from again, with no NDRs.

“HOW TO: View membership of a Dynamic Distribution Group” shows how to preview recipients returned by the RecipientFilter.

Bottomline, and best-practice: It’s a good idea to set the RecipientContainer property when creating new Dynamic Distribution Groups.

Update: You can use the Get-MessageTrackingLog cmdlet to parse Message Tracking logs and quickly determine the recipients returned upon expansion. The EXPAND event is logged when the Categorizer expands distribution groups.

Tags
Administration   Exchange 2007   PowerShell